Privacy Policy

The privacy boundary comes first

A.I. Sky Fortress inspects files that are already on your computer and reports what its detection logic considers dangerous. The lightweight checks run on your device. For the heavier analysis that runs in our cloud, your device computes a compact descriptor of each file and sends only that descriptor. The descriptor is a SHA-256 hash of the file, its size, its extension, a coarse location class (for example “downloads”), and structural features such as byte entropy and file-type header flags. The actual contents of your files never leave your device.

This boundary is enforced in code, not by promise: the descriptor is validated against a strict schema on both sides, and any field that could carry file contents is rejected at the boundary. Our audit records store only a SHA-256 of each descriptor, never the descriptor itself and never your file contents.

What we collect

• Account information you give us to sign in, such as your email address.
• A registration identifier for each computer you protect.
• Scan results: the mechanisms that ran, the threats found, counts, and timing.
• For cloud analysis, the file descriptor described above. Never file contents.
• If you arrive from a link that carries campaign details, a cookie set by this site keeps them for 30 days: the campaign’s source, medium and name, the ad variant and search term it carries, a partner’s referral code, and the page you arrived on. When you sign in, we store them with your account so we can count which campaigns bring new members. We share them with no one and use no third-party tracking pixels.

How your data is kept apart

Each account’s data is kept apart by our own servers: every request for account data must prove which account it belongs to, through your signed-in session or the key of a computer registered to your account, and only that account’s records are returned. The database that holds this data is reachable only from our own servers inside a private network. We apply no external analytics or advertising trackers, and telemetry is disabled throughout the product.

Email

Sign-in uses a one-time link and code sent to your email through our transactional email provider. We do not sell or share your email address.

Retention and deletion

Scan results and device records are tied to your account and the computer they came from. When you remove a computer, its access is revoked: its device token is cancelled and it can no longer report. The scan results it already produced stay with your account. To delete your account and the data associated with it, contact us at the address below.

Contact

Questions about this policy or your data: [email protected].